Re:Huawei Tops Intel as Top Linux Kernel Contributor for 5.10
by LinuxBender on Wednesday January 06, 2021 @01:01PM
(#25660336)
I would expect that malicious code would itself not be a proper backdoor, but rather a framework or hook or API that makes it easier to bypass restrictions. Subtle behavioral changes in the kernel combined with user space code could empower a state actor to move unnoticed. I think of it like 20 parts of a munition. Each piece by itself may look mostly harmless. This is all theory of course, but that is how I would do something malicious in the kernel. A theoretical example would be a simple kernel API combined with something like systemd's binfmt mount and a benign looking PNG image file that when parsed by binfmt, instructs the kernel to do something interesting such as tickle an undocumented CPU instruction.
Re:Huawei Tops Intel as Top Linux Kernel Contributor for 5.10
by dcolkitt on Wednesday January 06, 2021 @01:33PM
(#25660657)
Not just contributed. SELinux is primarily authored by the NSA.
Re:Huawei Tops Intel as Top Linux Kernel Contributor for 5.10
by haukem on Wednesday January 06, 2021 @02:46PM
(#25661389)
Now Huawei is fixing bugs in SELinux:
https://git.kernel.org/linus/68dae71b7cde628a082e982c0abbf6e...
Or reports them, so the NSA can fix them: https://git.kernel.org/linus/3a2f5a59a695a73e0cde9a61e0feae5...
All changes to The Linux kernel are getting publicly reviewed, so the hard thing is passing this technical review if you want to introduce a backdoor. If people know you, based on previous contributions, the review could be less hard, so it could make sense to build up a reputation before. In the Linux kernel not the company builds up the reputation, but the individual engineer who contributes. If this is a Huawei hardware it could be easier for an engineer with a Huawei mail address to get changes integrated, because people assume he known the driver and hardware well and people trust claims like, "this can not happen because the closed source firmware takes care of this".
If the Chinese intelligence agency wants to integrate a backdoor into mainline Linux it would be easier to just build up some own fake identities and use them. It probably would be easier to just analyze the Linux kernel and use bugs introduced by other people.
The NSA also contributed to the Linux kernel, look for contributes from a nsa.gov mail address.